--- title: Apple Detected Something on These iPhones | Threat Wire description: A roundup of cybersecurity news covering Apple's threat notifications warning iPhone users about mercenary spyware like Pegasus, a new US presidential... canonical: https://daily.dev/posts/apple-detected-something-on-these-iphones-threat-wire-mcszijswd twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Apple Detected Something on These iPhones | Threat Wire | daily.dev og:description: A roundup of cybersecurity news covering Apple's threat notifications warning iPhone users about mercenary spyware like Pegasus, a new US presidential... og:url: https://daily.dev/posts/apple-detected-something-on-these-iphones-threat-wire-mcszijswd og:image: https://api.daily.dev/og/posts/mCSzijsWD.png og:image:alt: Apple Detected Something on These iPhones | Threat Wire og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Apple Detected Something on These iPhones | Threat Wire **[Hak5](https://daily.dev/sources/hak5)** · 6 min read · 0 upvotes · 0 comments ## Summary A roundup of cybersecurity news covering Apple's threat notifications warning iPhone users about mercenary spyware like Pegasus, a new US presidential memorandum authorizing private companies to conduct offensive cyber operations against transnational criminal organizations, a self-propagating npm worm (a variant of the Shai-Hulud chain) that compromised a widely-downloaded package and targeted VS Code and Claude AI editor configs to spread further, a Pokemon Center data breach in the UK and Germany, Signal's new automatic key verification feature, Mozilla revoking an accidentally leaked GPG signing key, and news that Cursor has been acquired by xAI/SpaceX. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the Shai-Hulud npm worm variant that spread through the key v package in August 2026? It is a self-propagating supply chain worm identified by Elastic Security Labs on August 4, 2026, stemming from a compromise of the key v npm package, which had over 600 million downloads in the prior month. Its 711-kilobyte payload contains Dune-themed strings, hunts for credentials, and specifically targets VS Code and Claude configuration files so AI-assisted editors execute the attack code, propagating into 444 packages. _Track fast-moving supply chain worms like this on daily.dev before they reach your dependencies._ ### What did Apple's August 13, 2025 threat notifications warn iPhone users about? Apple sent threat notifications to targeted iPhone users in over 110 countries warning that it detected a mercenary spyware attack targeted at their phone, citing Pegasus from the NSO Group as an example of this category. Apple introduced this notification system in 2021, delivered via email and an iPhone banner popup, and has since notified users in over 150 countries total. _Developers securing mobile users can follow spyware disclosures like this through daily.dev._ ### What did the August 2026 US presidential memorandum on transnational cyber crime authorize? It authorized the National Coordination Center under the Homeland Security Task Force to approve private US companies to conduct offensive cyber surveillance and cyber effects operations against cyber-enabled transnational criminal organizations, not foreign governments themselves. The NCC was given 60 days from the memorandum's introduction to establish the program allowing approved companies to participate. _Security professionals tracking policy shifts like this can follow the fallout on daily.dev._ ## Similar posts on daily.dev - [How to Detect & Block Spyware Before It Hits You](https://daily.dev/posts/how-to-detect-block-spyware-before-it-hits-you-2gw2crh3d) · Medium · 0 upvotes · 0 comments - [Apple alerts exploit developer that his iPhone was targeted with government spyware](https://daily.dev/posts/apple-alerts-exploit-developer-that-his-iphone-was-targeted-with-government-spyware-vadlauxk2) · TechCrunch · 3 upvotes · 0 comments - [Major security alert for iPhone users](https://daily.dev/posts/major-security-alert-for-iphone-users-6l54y270k) · TechCentral · 3 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#apple](https://daily.dev/tags/apple), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/apple-detected-something-on-these-iphones-threat-wire-mcszijswd) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Apple Detected Something on These iPhones | Threat Wire","url":"https://daily.dev/posts/apple-detected-something-on-these-iphones-threat-wire-mcszijswd","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/apple-detected-something-on-these-iphones-threat-wire-mcszijswd"},"datePublished":"2026-08-20T16:35:15.609Z","dateModified":"2026-08-20T16:36:12.170Z","description":"A roundup of cybersecurity news covering Apple's threat notifications warning iPhone users about mercenary spyware like Pegasus, a new US presidential...","image":"https://i.ytimg.com/vi/KRvXdSuvMgg/sddefault.jpg","thumbnailUrl":"https://i.ytimg.com/vi/KRvXdSuvMgg/sddefault.jpg","isAccessibleForFree":true,"articleSection":"Hak5","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hak5","logo":"https://media.daily.dev/image/upload/s--NBqAwk3Z--/f_auto/v1710012451/logos/hak5","url":"https://daily.dev/sources/hak5"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/apple-detected-something-on-these-iphones-threat-wire-mcszijswd","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber,apple,npm","timeRequired":"PT6M","video":{"@type":"VideoObject","name":"Apple Detected Something on These iPhones | Threat Wire","description":"A roundup of cybersecurity news covering Apple's threat notifications warning iPhone users about mercenary spyware like Pegasus, a new US presidential...","thumbnailUrl":"https://i.ytimg.com/vi/KRvXdSuvMgg/sddefault.jpg","uploadDate":"2026-08-20T16:35:15.609Z","duration":"PT6M","url":"https://api.daily.dev/r/mCSzijsWD","embedUrl":"https://www.youtube.com/embed/KRvXdSuvMgg"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hak5","item":"https://daily.dev/sources/hak5"},{"@type":"ListItem","position":3,"name":"Apple Detected Something on These iPhones | Threat Wire"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/apple-detected-something-on-these-iphones-threat-wire-mcszijswd#faq","mainEntity":[{"@type":"Question","name":"What is the Shai-Hulud npm worm variant that spread through the key v package in August 2026?","acceptedAnswer":{"@type":"Answer","text":"It is a self-propagating supply chain worm identified by Elastic Security Labs on August 4, 2026, stemming from a compromise of the key v npm package, which had over 600 million downloads in the prior month. Its 711-kilobyte payload contains Dune-themed strings, hunts for credentials, and specifically targets VS Code and Claude configuration files so AI-assisted editors execute the attack code, propagating into 444 packages. Track fast-moving supply chain worms like this on daily.dev before they reach your dependencies."}},{"@type":"Question","name":"What did Apple's August 13, 2025 threat notifications warn iPhone users about?","acceptedAnswer":{"@type":"Answer","text":"Apple sent threat notifications to targeted iPhone users in over 110 countries warning that it detected a mercenary spyware attack targeted at their phone, citing Pegasus from the NSO Group as an example of this category. Apple introduced this notification system in 2021, delivered via email and an iPhone banner popup, and has since notified users in over 150 countries total. Developers securing mobile users can follow spyware disclosures like this through daily.dev."}},{"@type":"Question","name":"What did the August 2026 US presidential memorandum on transnational cyber crime authorize?","acceptedAnswer":{"@type":"Answer","text":"It authorized the National Coordination Center under the Homeland Security Task Force to approve private US companies to conduct offensive cyber surveillance and cyber effects operations against cyber-enabled transnational criminal organizations, not foreign governments themselves. The NCC was given 60 days from the memorandum's introduction to establish the program allowing approved companies to participate. Security professionals tracking policy shifts like this can follow the fallout on daily.dev."}}]} ```